ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

bun-do

v1.3.0

Manage bun-do tasks and projects — add tasks, edit tasks, delete tasks, toggle done, manage subtasks, and log project progress entries. Use when the user say...

⭐ 0· 575·0 current·0 all-time
byrazo@ricardofrantz
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
✓
Purpose & Capability
Name/description describe a local task manager backed by a local REST API; the SKILL.md exclusively documents calls to http://localhost:8000, a local data directory (~/.bun-do) and a suggested install command (bun install -g bun-do). No unrelated credentials, binaries, or external services are requested.
ℹ
Instruction Scope
Instructions stay within the stated scope (curl/python to query the local API, date resolution, CRUD operations, and examples). The SKILL.md also includes proactive/scheduled patterns (morning briefing, end of day, weekly review) that enable autonomous/scheduled behavior; the file appears truncated at the end so some rules are missing — this creates ambiguity about any final constraints or safety checks.
✓
Install Mechanism
There is no install spec in the registry entry (instruction-only). The doc suggests installing a CLI via 'bun install -g bun-do', which is a reasonable, proportional suggestion for a local app but is not enforced by the skill and would run out-of-band if the user chooses to install it.
✓
Credentials
The skill declares no required environment variables or credentials. It notes optional overrides (BUNDO_DATA_DIR and a --port flag) which are reasonable and proportional for a local data directory and port configuration.
ℹ
Persistence & Privilege
always is false (good). The skill does allow autonomous invocation (disable-model-invocation=false) and the instructions explicitly include proactive/autonomous patterns — if you allow the agent to invoke skills autonomously, it could run scheduled operations against your local service. That combination is expected for a task manager but worth conscious consideration.
Assessment
This skill appears to be a straightforward local-first adapter for a bun-do REST server running on localhost and does not request secrets or external network access. Before installing or enabling autonomous use: 1) Verify you actually run (or trust) a bun-do server on http://localhost:8000 — otherwise the skill's curl calls will fail or be a no-op. 2) The SKILL.md is truncated; review the full author documentation (if available) to confirm any omitted safety rules. 3) If you enable autonomous invocation, be aware the skill contains proactive scheduled patterns (morning briefing, EOD, weekly review) — make sure you are comfortable allowing the agent to run those actions against local data and confirm the bun-do server is not exposed to untrusted networks. 4) If you plan to install the suggested CLI, run the install command manually and inspect the package before granting global install privileges.

Like a lobster shell, security has layers — review code before you run it.

bunvk97fq7pz11n80csbjs8432qcd981c7a3latestvk97fq7pz11n80csbjs8432qcd981c7a3local-firstvk97fq7pz11n80csbjs8432qcd981c7a3mcpvk97fq7pz11n80csbjs8432qcd981c7a3paymentsvk97fq7pz11n80csbjs8432qcd981c7a3projectsvk97fq7pz11n80csbjs8432qcd981c7a3self-hostedvk97fq7pz11n80csbjs8432qcd981c7a3tasksvk97fq7pz11n80csbjs8432qcd981c7a3todovk97fq7pz11n80csbjs8432qcd981c7a3

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments